EC-SpMV: Exact, Encrypted & Compressed Multiplication

• EC-SpMV is a family of sparse matrix–vector multiplication methods defined by varying arithmetic semantics, storage designs, and system objectives.
• The approaches leverage techniques such as lazy modular reduction, explicitly cached GPU kernels, and compressed formats for exact, encrypted, and energy-conscious computations.
• Applications range from black-box linear algebra and homomorphic encryption to efficient sparse LLM inference and energy-saving Boolean matrix operations.

EC-SpMV denotes several specialized forms of sparse matrix–vector multiplication centered on the kernel $y = A x$, but differentiated by arithmetic semantics, storage design, and systems objectives. In the cited literature, the label has been used for exact arithmetic over finite fields and modular rings, explicitly cached GPU kernels, ciphertext–ciphertext evaluation under homomorphic encryption, extraction-and-compression schemes for sparse LLM inference, and energy-conscious execution directly on losslessly compressed Boolean matrices (Boyer et al., 2010, Chen, 2022, Gao et al., 5 Mar 2026, Lin et al., 16 Jul 2025, Tosoni et al., 2024). The shared invariant is sparse linear application; the substantive differences lie in whether the principal constraint is exactness, memory traffic, communication, privacy, storage overhead, or energy.

1. Terminology and semantic range

In the cited literature, the label “EC-SpMV” appears in several distinct senses. The earliest cited use is the exact sparse matrix–vector multiplication of Dumas, Gautier, and Pernet, formulated over $\mathbb{F}_p$ and $\mathbb{Z}/m\mathbb{Z}$ (Boyer et al., 2010). Later uses attach the same label to explicitly cached GPU kernels (Chen, 2022), encrypted ciphertext–ciphertext SpMV under BFV (Gao et al., 5 Mar 2026), sparse-LLM extraction-and-compression kernels (Lin et al., 16 Jul 2025), and energy-conscious SpMV over compressed Boolean-matrix formats (Tosoni et al., 2024).

Interpretation of EC-SpMV	Computational setting	Defining mechanisms
Exact sparse matrix–vector multiplication	Finite fields and modular rings	Lazy modular reduction, hybrid sparse formats, LinBox integration
Explicitly cached SpMV	GPU memory hierarchy	Shared-memory caching of $x$, sliced ELL + ER, compact local indices
Encrypted ciphertext–ciphertext SpMV	Homomorphic encryption	CSSC format, chunked packing, rotations, masking
Extraction-and-compression SpMV	Sparse LLM inference	Hierarchical block extraction, EC-CSR, delta indexing
Energy-conscious compressed SpMV	Boolean matrices, real vectors	Zuckerli, k²-tree, mm-repair, direct execution on compressed data

This multiplicity is important because identical acronymal usage does not imply algorithmic equivalence. Exact EC-SpMV is about modular correctness; encrypted EC-SpMV is about confidentiality; sparse-LLM EC-SpMV is about batch-size-1 GPU efficiency; and energy-conscious EC-SpMV is about space–time–energy trade-offs on compressed data.

2. Exact arithmetic EC-SpMV over finite fields and rings

Exact EC-SpMV computes sparse matrix–dense vector products in exact arithmetic rather than in floating point. For $A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$ or $A \in \mathbb{F}_p^{n \times n}$ and $x$ in the corresponding vector space, the output is $y = A x \bmod m$ or $y = A x \bmod p$, with

$y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$

where $\mathbb{F}_p$0. The motivation is black-box linear algebra: exact arithmetic avoids rounding and cancellation, which is essential for rank and minimal-polynomial computations (Boyer et al., 2010).

The implementation space is organized around sparse formats and delayed modular reduction. COO exposes element-wise parallelism but, on GPUs, requires many reductions and often performs poorly because of atomics and divergence. CSR offers row-level parallelism and delayed reduction. ELL and ELLR are effective when row lengths are uniform; on CPUs, row-major ELL exploits cache locality, while on GPUs, column-major ELL yields coalesced memory access. Hybrid layouts such as ELL(R)+CSR and ELL(R)+COO are used for robust GPU performance, and the paper also introduces a custom COO′ format that is essentially CSR restricted to nonempty rows. Modular arithmetic is optimized through lazy reduction: if the accumulator supports magnitude up to $\mathbb{F}_p$1, one can safely perform up to

$\mathbb{F}_p$2

multiply-adds before reduction. Using symmetric representatives doubles the safe accumulation window, at the cost of a slightly more expensive final correction step.

A further optimization is the $\mathbb{F}_p$3 specialization. When many entries are equal to $\mathbb{F}_p$4, submatrices of $\mathbb{F}_p$5 can replace multiplications with additions and subtractions and can eliminate value storage. The reported gains are up to roughly $\mathbb{F}_p$6 on matrices of all ones and about $\mathbb{F}_p$7 when about $\mathbb{F}_p$8 of entries are $\mathbb{F}_p$9. GPU kernels map one row, or a chunk of a long row, to one thread or warp; accumulators are kept in registers; and performance improves substantially when $\mathbb{Z}/m\mathbb{Z}$0, $\mathbb{Z}/m\mathbb{Z}$1, and $\mathbb{Z}/m\mathbb{Z}$2 remain resident on the device across iterations rather than being transferred at every SpMV.

The exact EC-SpMV library was integrated into LinBox, where it accelerated black-box methods such as block Wiedemann. In the sequence-generation phase, one computes

$\mathbb{Z}/m\mathbb{Z}$3

using repeated EC-SpMV on multi-vectors. The paper reports that sequence generation became faster than the native implementation, and the total runtime of parallel block Wiedemann rank computation on $\mathbb{Z}/m\mathbb{Z}$4 cores fell from $\mathbb{Z}/m\mathbb{Z}$5 to $\mathbb{Z}/m\mathbb{Z}$6 on EX5; for the same matrix, the sequence step dropped from $\mathbb{Z}/m\mathbb{Z}$7 to $\mathbb{Z}/m\mathbb{Z}$8. On the polynomial side, OpenMP-parallel polynomial matrix multiplication reached up to about $\mathbb{Z}/m\mathbb{Z}$9 speedup on $x$0 cores, while the parallel sigma-basis PM-Basis achieved up to about $x$1 speedup. The principal edge cases remained irregular sparsity, padding overhead in ELL, load imbalance in CSR, and overflow management for very small or very large moduli.

3. Communication locality and memory-hierarchy specialization

Related work pursued analogous goals through topology-aware communication, explicit caching, and architecture-specific sparse formats, even when the acronym itself changed. NAPSpMV reduces expensive inter-node communication by aggregating vector entries at the node level and replacing many rank-to-rank messages with fewer node-pair exchanges; EHYB explicitly caches tiles of the input vector in GPU shared memory; and ECM-guided tuning on A64FX replaces CRS with SELL-C-$x$2 to approach bandwidth saturation (Bienz et al., 2016, Chen, 2022, Alappat et al., 2021).

In NAPSpMV, the matrix is partitioned across MPI ranks, then off-process dependencies are refined into on-node and off-node components. The communication pattern is reorganized into intra-node gather, inter-node send/receive, and intra-node scatter. The time model distinguishes

$x$3

and the motivation is that intra-node messages are cheaper than inter-node injections. On Blue Waters, the method scaled to $x$4 MPI processes and improved performance over the reference by up to two orders of magnitude on random matrices, with especially strong gains on coarse AMG levels where standard SpMV injects many small messages.

EHYB targets a different bottleneck: repeated global-memory fetches of irregularly indexed $x$5 on GPUs. It partitions the matrix into a sliced ELL part and an extra-rows part. Each CUDA block loads a contiguous tile of $x$6 into shared memory, and indices in the cached sliced-ELL part are stored as $x$7-bit partition-local offsets. This reduces column-index traffic and amortizes $x$8 loads across many references. On an NVIDIA Tesla V100, EHYB outperformed holaSpMV, CSR5, merge-based CSR, and cuSPARSE in both single and double precision; against cuSPARSE generic SpMV ALG2, the reported average speedup was $x$9 in single precision and $A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$0 in double precision.

On A64FX, the central result is that CRS is not a good practical choice because short inner loops, gather latency, and reduction overhead waste the bandwidth available from the HBM2-backed Core Memory Groups. The ECM model identifies partial overlap at L1 and full overlap at the L2/memory interface, and the optimization path is SELL-C-$A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$1 with SVE intrinsics, padding, and column-wise accumulation across chunk height $A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$2. With $A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$3, SELL-16-1 saturated CMG bandwidth at about $A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$4 cores, whereas SELL-8-1 saturated at $A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$5 cores. The same study also explored system-level tuning on Fugaku and reported median energy savings of about $A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$6 for SpMV using eco mode and frequency reduction. These results do not redefine EC-SpMV as a single scheme; they show that sparse matrix–vector multiplication is repeatedly reformulated around the dominant locality bottleneck of the target platform.

4. Encrypted EC-SpMV under homomorphic encryption

In the encrypted interpretation, EC-SpMV is ciphertext–ciphertext sparse matrix–vector multiplication carried out under homomorphic encryption. The target operation is again $A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$7 with

$A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$8

but now both operands remain encrypted throughout evaluation. The implementation uses a three-party model: Client A owns the sparse matrix, Client B owns the dense vector, and a semi-honest cloud server performs the homomorphic evaluation. Client A shares only plaintext column-index metadata with Client B to reorganize the vector, while the cloud does not learn nonzero locations or row or column indices (Gao et al., 5 Mar 2026).

The core structural contribution is CSSC, “Compressed Sparse Sorted Column.” For a sparse matrix $A \in (\mathbb{Z}/m\mathbb{Z})^{n \times n}$9, CSSC is

$A \in \mathbb{F}_p^{n \times n}$0

where VA stores nonzero values of the left-aligned matrix in column-major order, CI stores original column indices, RM is the row permutation after sorting rows by descending nnz, and CP is a column-pointer prefix-sum array. The format is designed for HE rather than for classical CSR/CSC traversal: rows are sorted by nnz, nonzeros are left-aligned within each row, and the matrix is flattened column-by-column so that ciphertext slots align deterministically with reorganized vector slots. A chunked packing scheme ensures that each chunk fits within one ciphertext.

The HE layer uses BFV with ring degree $A \in \mathbb{F}_p^{n \times n}$1, plaintext modulus $A \in \mathbb{F}_p^{n \times n}$2, coefficient-modulus chain $A \in \mathbb{F}_p^{n \times n}$3, and $A \in \mathbb{F}_p^{n \times n}$4-bit security. One ciphertext–ciphertext multiplication is performed per chunk, followed by a fixed-depth aggregation phase consisting of rotations, additions, and one ciphertext–plaintext masking multiplication per chunk. The operation counts are explicit: for $A \in \mathbb{F}_p^{n \times n}$5 chunks and $A \in \mathbb{F}_p^{n \times n}$6 the maximum chunk width, Step 1 uses $A \in \mathbb{F}_p^{n \times n}$7 HE-Mult operations; Step 2 uses $A \in \mathbb{F}_p^{n \times n}$8 HE-CMult operations, $A \in \mathbb{F}_p^{n \times n}$9 HE-Rot operations, and $x$0 HE-Add operations. The total multiplicative depth is “$x$1,” so no bootstrapping is required.

The reported experimental profile emphasizes both runtime and memory reduction relative to prior HE baselines. Average runtime improvements exceed $x$2, with peaks above $x$3; for example, on p2p-Gnutella31 the method ran in $x$4 against baselines ranging from $x$5 to more than $x$6 days. Memory savings range from about $x$7 to $x$8 in the examples summarized in the paper. The method is nevertheless not fully structure-hiding: CI metadata is revealed to Client B, which means column-wise sparsity structure may leak to that party. The design also assumes static sparsity, shallow arithmetic depth, and chunk sizes that remain compatible with the slot capacity of the BFV parameter set.

5. EC-SpMV for sparse LLM inference

In sparse LLM inference, EC-SpMV refers to an extraction-and-compression SpMV scheme specialized for the decoder phase at batch size $x$9. In that regime, dense GEMMs degenerate to GEMV, and after unstructured pruning they become SpMV. The problem is not extreme sparsity in the classical scientific-computing sense; it is moderate sparsity with substantial per-element indexing overhead and semi-regular local structure. The proposed response is a co-design of hierarchical block extraction and a compressed sparse format called EC-CSR (Lin et al., 16 Jul 2025).

The block-extraction algorithm identifies multi-granularity blocks by repeatedly matching rows with overlapping column sets, first forming as many $y = A x \bmod m$0-row blocks as possible, then aggregating them into $y = A x \bmod m$1-row, $y = A x \bmod m$2-row, and coarser structures through a meta-matrix representation. If a nonzero belongs to a block of granularity $y = A x \bmod m$3, the amortized cost of loading one $y = A x \bmod m$4 element is reduced from $y = A x \bmod m$5 to $y = A x \bmod m$6. The paper writes the total input-vector access cost as

$y = A x \bmod m$7

so the design objective is to maximize $y = A x \bmod m$8 wherever possible. After extraction, the algorithm applies block clipping and reordering for load balance.

EC-CSR stores each block set using row indices, block pointers, base indices, delta indices, block values, and set metadata. Given sorted column indices $y = A x \bmod m$9, the format stores a base index $y = A x \bmod p$0 and deltas $y = A x \bmod p$1, reconstructing

$y = A x \bmod p$2

This permits low-precision delta storage because adjacent columns in sparse LLM weights often differ by small strides. The paper reports that for LLaMA weights pruned to $y = A x \bmod p$3, $y = A x \bmod p$4, and $y = A x \bmod p$5 sparsity, most deltas are below $y = A x \bmod p$6, $y = A x \bmod p$7, and $y = A x \bmod p$8, respectively, which enables uint8 delta encoding at those sparsity levels.

The GPU kernel maps one warp to one block. Each warp splits block columns into warp-size sub-blocks, streams vectorized delta-index and value segments, keeps per-row accumulators in registers, and uses warp-level reduction before atomic accumulation into the output rows. On real sparse weight matrices from LLaMA and OPT models, EC-SpMV achieved up to $y = A x \bmod p$9 speedup over state-of-the-art SpMV libraries and reduced storage overhead by up to $y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$0 compared with CSR. The end-to-end decoder case study in llama.cpp for LLaMA2-7B at $y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$1 sparsity on an RTX 3090 reported $y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$2, $y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$3, and $y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$4 tokens/s at generation lengths $y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$5, $y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$6, and $y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$7, versus $y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$8, $y_i = \sum_{j \in N(i)} A_{ij} x_j \bmod m,$9, and $\mathbb{F}_p$00 tokens/s for the dense baseline; memory footprint fell from $\mathbb{F}_p$01 GB in dense form and $\mathbb{F}_p$02 GB in CSR-32 to $\mathbb{F}_p$03 GB in EC-CSR. The stated scope remains batch-size-$\mathbb{F}_p$04, static sparsity, and single-GPU execution; for higher batch sizes, dense or block-sparse GEMM may again dominate.

6. Energy-conscious compression and related numerical-robustness directions

A further meaning of EC-SpMV is explicitly “energy-conscious, lossless compressed sparse matrix–vector multiplication performed directly on compressed formats, without prior decompression.” Here the matrices are Boolean, vectors are real-valued, and the right product is

$\mathbb{F}_p$05

The paper evaluates Zuckerli, k²-tree, and grammar-compressed mm-repair representations on server and edge platforms, measuring execution time, compression ratio, and energy rather than only throughput (Tosoni et al., 2024).

The three formats embody different trade-offs. Zuckerli is usually the most succinct among the computation-friendly formats, reaching $\mathbb{F}_p$06 bits per edge on indochina-2004 and about $\mathbb{F}_p$07 BPE on uk-2005 and arabic-2005. k²-tree is less succinct but often faster than Zuckerli in single-thread runs. Grammar-based mm-repair variants are generally the fastest, with Re32 at the high-performance end and Reans reducing storage relative to other grammar encodings. The principal systems result is that selecting the right compressed format yields $\mathbb{F}_p$08–$\mathbb{F}_p$09 orders-of-magnitude energy savings across datasets and both platforms. A second result is that time-optimal and energy-optimal thread counts diverge: runtime may continue improving up to $\mathbb{F}_p$10–$\mathbb{F}_p$11 threads on the server, while energy often stops decreasing at $\mathbb{F}_p$12–$\mathbb{F}_p$13 threads; on Raspberry Pi, using $\mathbb{F}_p$14 threads on a $\mathbb{F}_p$15-core device can increase both time and energy. A common misconception is therefore that faster execution automatically minimizes energy; the reported measurements contradict that assumption.

A related, but terminologically distinct, line studies multiple-precision SpMV as a remedy for round-off sensitivity in Krylov methods (Kouya, 2024). That work does not redefine the acronym EC-SpMV, but it is relevant to the broader question of specialized sparse matrix–vector products under nonstandard numerical constraints. Using AVX2 SIMD, OpenMP, and multi-component DD, TD, QD, and MPFR arithmetic, it reports speedups up to $\mathbb{F}_p$16 for real SpMV and $\mathbb{F}_p$17 for complex SpMV on $\mathbb{F}_p$18 threads in the mixed-precision setting. The numerical motivation differs from exact modular arithmetic: the goal is not residue-class exactness, but stabilization of convergence by reducing round-off errors. This suggests that the broader EC-SpMV landscape is best understood not as a single algorithmic lineage, but as a recurrent pattern in which the sparse matrix–vector product is re-engineered around the dominant correctness or efficiency constraint of a given domain.